DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use AWS Certificate Manager to issue a certificate for the RDS instance

  Why it's wrong here

  AWS Certificate Manager (ACM) issues public/private certificates for use with load balancers, CloudFront, or API Gateway, but ACM certificates cannot be installed directly on an Amazon RDS instance. Even if a certificate were used to secure the client-to-database connection, TLS/SSL only encrypts data in transit and does nothing to protect the database files, snapshots, or backups while they are stored on disk. Therefore, this approach does not provide the required encryption at rest.

• ✗

  Place the RDS instance in a private subnet and use VPC peering

  Why it's wrong here

  Placing the RDS instance in a private subnet and using VPC peering only changes network topology and routing; it does not add any encryption layer. VPC peering traffic flows across the AWS network but is not encrypted by VPC peering itself, and a private subnet simply restricts direct Internet access. Database files remain unencrypted on disk, so this option fails to meet both the at-rest encryption requirement and the in-transit encryption requirement.

• ✓

  Enable encryption at rest on the RDS instance and enforce SSL connections

  Why this is correct

  Enabling RDS encryption at rest encrypts the underlying storage, automated backups, snapshots, and read replicas using AWS KMS AES-256 encryption, satisfying the data-at-rest requirement. Enforcing SSL connections (for example, by setting rds.force_ssl=1 or requiring ssl-mode in the client) encrypts data between the application and the database, covering data in transit. Note that enabling encryption at rest on an existing unencrypted MySQL instance requires restoring from an encrypted snapshot rather than modifying the instance in place, but together these controls fully address the stated security need.

• ✗

  Use AWS KMS to encrypt the database before inserting data and decrypt on read

  Why it's wrong here

  Calling AWS KMS from your application to encrypt values before inserting them and decrypting them after reading is client-side encryption, not native RDS encryption at rest. This approach leaves the database engine, transaction logs, backups, and snapshots unencrypted, and it forces every query and application code path to manage encryption keys and data transformations. AWS KMS is the key manager used by RDS encryption at rest, but the RDS service itself must be configured to encrypt the data files, not your application.

Go deeper

Related to this question